Smart Meeting Notes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:25 AM UTC
• Version: 1.0.0

Overview

This skill does useful meeting summarization, but it automatically stores sensitive meeting notes locally without clear user control.

Review before installing if your meetings may include confidential, HR, legal, customer, or personal information. Use it only if you are comfortable with notes being saved under ~/.openclaw/meetings/, and prefer explicit confirmation before saving, reading history, installing Whisper, or sending audio to an external API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:95
• Finding: Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95–101 **Vulnerability Type**: Unpinned dependency installation from a public package repository **Risk Level**: Medium ### Vulnerable Code ```markdown ## Audio Handling If the user provides an audio file: 1. Check if Whisper CLI is available (`which whisper`) 2. If yes: transcribe with `whisper [file] --output_format txt` 3. If no: tell user to install: `pip install openai-whisper` or use the OpenAI Whisper API 4. Then process the transcript as normal ``` ### Technical Analysis The Skill directs the user to install `openai-whisper` without specifying an audited version, validating package hashes, or using a locked dependency set. Consequently, the package version and transitive dependency graph are resolved dynamically when the command is run. Python package installation can execute package-controlled build and installation logic. If the package repository, a future package release, or one of its transitive dependencies is compromised, following this instruction could execute untrusted code with the privileges of the user running `pip`. The issue is an unsafe supply-chain practice rather than evidence that the named package is currently malicious. ### Attack Path 1. The user provides an audio file and the Skill determines that the Whisper CLI is unavailable. 2. The Skill instructs the user to run `pip install openai-whisper`. 3. `pip` resolves the latest permitted package and its transitive dependencies from the configured package index. 4. A compromised or unexpectedly modified release supplies malicious build or installation logic. 5. The installation process executes that logic under the installing user's account. 6. The malicious dependency can access resources available to that account and may modify the associated Python environment. ### Impact Assessment Successful exploitation could obtain the privileges of the account running `pip`. Depending on that account and environm ...[truncated 382 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `openai-whisper` and every transitive dependency to reviewed versions in a lock file. 2. Require package hashes, such as through a requirements file used with `pip install --require-hashes`. 3. Recommend installation in a dedicated, non-privileged virtual environment rather than globally or with administrator privileges. 4. Require explicit user approval before installing any software. 5. Document the trusted package index and disable unreviewed alternate indexes. 6. Periodically review pinned dependencies for security advisories and update them through a controlled process. 7. Prefer a pre-approved transcription tool already available in the execution environment where possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74
• Finding: Unsanitized Meeting Topic Used in Persistent File Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 74 **Vulnerability Type**: Path traversal and unintended file overwrite risk **Risk Level**: Medium ### Vulnerable Code ```markdown Save all meeting notes to `~/.openclaw/meetings/[date]-[topic].md` ``` ### Technical Analysis The Skill requires the meeting topic to be incorporated into a persistent filename but provides no instructions to sanitize the topic, reject path separators, remove traversal sequences, or verify the resolved destination. The topic can be derived from user-provided or attacker-controlled meeting content. If an implementing agent substitutes the topic literally, values containing sequences such as `../`, absolute-path syntax, control characters, or platform-specific separators could cause the resulting path to escape `~/.openclaw/meetings/`. A colliding sanitized or unsanitized name could also overwrite an existing file if safe creation semantics are not used. Exploitation depends on the agent or storage implementation treating the topic as a raw path component. The document does not contain executable path-construction code, but its prescribed behavior omits the controls necessary to prevent this condition. ### Attack Path 1. An attacker supplies or influences a transcript from which the meeting topic is extracted. 2. The topic contains path-manipulation content, such as `../../target`, or a filename chosen to collide with an existing file. 3. The agent substitutes the topic directly into `~/.openclaw/meetings/[date]-[topic].md`. 4. The filesystem resolves the traversal components or conflicting filename. 5. The generated notes are written outside the intended meeting directory or replace an existing user-writable file. ### Impact Assessment Successful exploitation could create or overwrite files accessible to the user running the Skill. The maximum direct privilege is limited to that user's filesystem permissions. Potential effects include loss or corruption ...[truncated 400 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Convert the topic to a strict filename slug using a small allowlist, such as ASCII letters, digits, hyphens, and underscores. 2. Remove or reject `..`, path separators, absolute-path markers, control characters, shell metacharacters, and platform-specific reserved names. 3. Apply a fixed maximum filename length and use a safe fallback such as `untitled-meeting`. 4. Construct the destination relative to a fixed meeting directory using a path-handling library rather than string concatenation. 5. Resolve or canonicalize both the base directory and candidate destination, then verify that the destination remains beneath `~/.openclaw/meetings/`. 6. Create the directory and files with restrictive permissions suitable for potentially confidential meeting information. 7. Avoid silent overwrites by using exclusive file creation or adding a collision-resistant identifier. 8. Treat transcript content solely as data and never permit it to choose an arbitrary storage path. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s declared purpose is meeting summarization, but the instructions expand it into persistent storage, history management, and retrieval of prior notes. That broadens data handling from ephemeral summarization into a local meeting archive containing potentially sensitive business or personal discussions, increasing privacy and unauthorized-access risk beyond what a user may expect.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes local filesystem persistence and later retrieval of meeting content without that capability being clearly justified by the manifest purpose alone. Because meeting notes often contain sensitive operational, HR, legal, or personal information, silently writing them to disk and reloading them later creates confidentiality and retention risks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instruction to save all meeting notes to ~/.openclaw/meetings/ introduces persistent storage of potentially sensitive meeting content without any warning, consent prompt, or data minimization guidance. Users may reasonably expect a summary operation, not automatic retention of transcripts, decisions, action items, and quotes on local disk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The audio-handling instructions suggest transcribing recordings with Whisper CLI or an external API without any privacy notice or consent guidance. Meeting recordings may contain highly sensitive spoken information, and sending them to external services or even processing them locally can have legal, policy, and confidentiality implications if not clearly disclosed.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill directs the agent to load the most recent meeting notes from local storage when asked to follow up, but it does not warn that historical data will be accessed. This can expose prior sensitive meeting content unexpectedly, especially on shared systems or when the user did not realize earlier notes were retained.

Static analysis

No suspicious patterns detected.